[PATCH 0/1] MR8168: ntdll: Fix out-of-bound read in RtlIpv6AddressToStringExA.

[Yuxuan Shui (＠yshui)]

Bound check was performed after the array access, resulting in out-of-bound read of IN6_ADDR.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/8168

[PATCH 1/1] ntdll: Fix out-of-bound read in RtlIpv6AddressToStringExA.

[Yuxuan Shui]

From: Yuxuan Shui <yshui(a)codeweavers.com>

Bound check was performed after the array access, resulting in out-of-bound read of IN6_ADDR.
---
 dlls/ntdll/rtlstr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/ntdll/rtlstr.c b/dlls/ntdll/rtlstr.c
index fcef8f4ee15..f494d97ec27 100644
--- a/dlls/ntdll/rtlstr.c
+++ b/dlls/ntdll/rtlstr.c
@@ -2457,7 +2457,7 @@ NTSTATUS WINAPI RtlIpv6AddressToStringExA(const IN6_ADDR *address, ULONG scope,
     for (i = 0; i < ipv6_end; i++)
     {
         len = 0;
-        while (!address->s6_words[i] && i < ipv6_end)
+        while (i < ipv6_end && !address->s6_words[i])
         {
             i++;
             len++;
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/8168